THRIFT-6275: Present the client certificate from the Go cross-test client

[slachiewicz]

JIRA: THRIFT-6275
Client: go,test

The 18 py-go_*-ip-ssl cross-test rows have been listed as known failures since 2015.

The Go test client sent no client certificate, while the Python test server requires one, so every socket transport over SSL failed the handshake with tls: certificate required. The client now takes the same --certPath flag as the server and loads client_v3.crt and client_v3.key into the TLS configuration it uses for sockets and HTTPS; tests.json passes the flag. This alone makes the 18 rows pass in the cross-test image, which builds with Go 1.24.

Loading the certificate exposes a second problem on newer Go. client_v3.crt as shipped lists ::ffff:127.0.0.1 among its alternative names, and Go 1.27.0 and later reject a certificate with an IPv4-mapped IPv6 SAN (x509: SAN iPAddress contains IPv4-mapped IPv6 address, crypto/x509/parser.go, no GODEBUG). The lib-go job runs on Go 1.26 and 1.27, and go test ./src/common/ in test/go now loads the certificate, so it would fail there on 1.27. THRIFT-3660 added that entry in 2016 for the Python peer-address check, which since THRIFT-6201 reduces a mapped address to its IPv4 form itself on Python 3.12 and later, and with #3839 (THRIFT-6233) on every Python version. This PR depends on #3839: without it a Python server on 3.11 or earlier still runs ssl.match_hostname, which would refuse an IPv4 client of a dual-stack listener once the mapped entry is gone. The certificate is regenerated self-signed with the same key, the same distinguished name and extensions, and the alternative names 127.0.0.1, ::1 and localhost. The Java client keystore is regenerated from it with the command in the keys README. The README recipe itself now produces what is shipped; it described a CA-signed certificate that the Python server rejects with unable to get local issuer certificate, which is not how the shipped certificate was made.

The 18 entries leave test/known_failures_Linux.json, so the cross-test jobs here are the check that the rows pass.

What is not touched: the other 59 Go entries in the file, which fail for other reasons recorded on THRIFT-5809.

Verified: the shipped client_v3.crt loads with tls.LoadX509KeyPair under go1.24.3 and go1.26.2 and fails under go1.27.1 with the error above; all twelve py-go SSL combinations (binary, compact, json, header over buffered, framed, zlib) pass locally with a Python server built from master and the Go client from this branch; go test ./src/common/ in test/go passes with the regenerated certificate on Go 1.27; the keystore's certificate fingerprint matches the regenerated client_v3.crt. Not run locally: the other clients against the regenerated certificate, which the cross-test matrix covers.

This change was created with AI assistance.